CVE-2005-1245: XSS
Published Apr 24, 2005
·Updated
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.2, when using HTML Tidy ($wgUseTidy), allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Affected Software
17 affected components
MediaWiki MediaWiki=1.3.5
MediaWiki MediaWiki=1.3.6
MediaWiki MediaWiki=1.4_beta3
MediaWiki MediaWiki=1.3
MediaWiki MediaWiki=1.3.10
MediaWiki MediaWiki=1.3.4
MediaWiki MediaWiki=1.3.9
MediaWiki MediaWiki=1.4_beta4
MediaWiki MediaWiki=1.4_beta1
MediaWiki MediaWiki=1.3.3
MediaWiki MediaWiki=1.3.1
MediaWiki MediaWiki=1.3.7
MediaWiki MediaWiki=1.3.11
MediaWiki MediaWiki=1.3.8
MediaWiki MediaWiki=1.3.2
MediaWiki MediaWiki=1.4_beta2
MediaWiki MediaWiki=1.4_beta5
Remediation
Patch Available
Patch Available
Event History
Apr 24, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-1245?
CVE-2005-1245 is considered a moderate severity vulnerability due to its ability to execute arbitrary scripts.
2
How do I fix CVE-2005-1245?
To fix CVE-2005-1245, upgrade your MediaWiki installation to version 1.4.2 or later.
3
What versions of MediaWiki are affected by CVE-2005-1245?
CVE-2005-1245 affects MediaWiki versions prior to 1.4.2, including various 1.3.x and 1.4 beta versions.
4
Can attackers exploit CVE-2005-1245 remotely?
Yes, attackers can exploit CVE-2005-1245 remotely to inject malicious scripts.
5
Is there any workaround for CVE-2005-1245?
Disabling the HTML Tidy feature in your MediaWiki configuration can serve as a temporary workaround for CVE-2005-1245.